CVE-2021-39226Snapshot authentication bypass in grafana
Updated under an hour ago ()
Does this affect you?
It affects grafana and 1 other product. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Aug 25, 2022; federal agencies had to remediate by Sep 15, 2022. Treat that date as your deadline.
Do this next
Free account, 1 product
Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-287
- Known exploited
- Added to CISA KEV Aug 25, 2022; federal remediation due Sep 15, 2022Apply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 99.93% (percentile 100)
- Assigned by
- GitHub_M
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
grafana grafana grafana:grafana (from the name) | from 8.0.0, < 8.1.6; before 7.5.11 | CNA record |
grafana grafana grafana:grafana | before 7.5.11; from 8.0.0 before 8.1.6 | NVD |
fedoraproject fedora fedoraproject:fedora | 34; 35 | NVD |
References
- https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9x-refsource-confirm, exploit, mitigation, vendor-advisory
- https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269x-refsource-misc, patch
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-11/x-refsource-misc, release-notes
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6/x-refsource-misc, release-notes
- http://www.openwall.com/lists/oss-security/2021/10/05/4mailing-list, x-refsource-mlist, third-party-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6ANHRDBXQT6TURLP2THM26ZPDINFBEG/vendor-advisory, x-refsource-fedora, broken-link
- https://security.netapp.com/advisory/ntap-20211029-0008/x-refsource-confirm, third-party-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCKBFUSY6V4VU5AQUYWKISREZX5NLQJT/vendor-advisory, x-refsource-fedora, broken-link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-39226us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.